feat(k8s): the ConfigMap effect-receipt row, observed, guarded and never pruned (#2074)

[lex00]

Item 1 of #2074. Item 2 stays open on the issue with a comment recording what a decision needs.

The problem

The only receipt materialization row was aws SsmParameter, so a cluster-only project could not use effect() receipts or WatchOp stale-receipt reporting at all, even though the effect-receipts concept page documents the feature without qualification.

What this lands

A k8s ConfigMap receipt row: EffectReceipt under the k8s lexicon with entityType K8s::Core::ConfigMap, carrying the core marker so lint, plan and apply recognize it lexicon-independently. The resolution split is unchanged from the aws row: static hashes at synthesis, references render the placeholder note.

The receipt ConfigMap is named chant-receipt.<stack>.<env>.<effect>, from the same ownership fields that stamp markers, with . as the separator because no segment may contain one, so two different stacks can never render the same name. It lives in k8s.receipts.namespace from chant.config.ts, defaulting to default, never derived from the stack or environment, because a guessed namespace is one chant would then have to create.

Three legs are covered against the fake cluster. The store server-side-applies the ConfigMap. describeResources reads it back where core's readReceiptValue looks, and planReceipts turns that into an effect row when stale and a noop when applied. The WatchOp staleness phase reports absent, differs or clean and issues no write.

Two properties the orchestrator asked for. The written ConfigMap carries the ownership marker labels plus an effect-receipt label, and pruneOrphans now reports it retained rather than deleting it, the same treatment a generated-once Secret gets, because a receipt is chant-owned and in no apply set by construction. The deep observation leg returns presence and uid with an empty property tree, so a receipt is never drift and never an unclaimed field; a test drives the real deep diff with the real k8s hooks over a stale receipt and asserts every bucket is empty.

The rendering channel

The aws row parks receipt rows in the CloudFormation template's Metadata, outside Resources. Kubernetes YAML has no channel outside the documents, and a document is precisely what an applier applies, so the k8s rows ride a trailing # chant:effect-receipts <json> comment on the manifest output. loadAll yields no object for it, so a receipt is structurally unreachable from applyManifest, while it still rides the one build string the observation legs receive. A test asserts a manifest plus the comment parses to exactly one document. The alternative, a sidecar file, was rejected because it would cost the observation leg its address source.

Docs

The concept page's aws sentence became a two-row table plus a kubectl get configmap walk-away example and a paragraph on the prune exclusion. The k8s serialization page gained the row; its twin was regenerated. COR022 and COR023 fixtures cover the k8s row.

The docs prose baseline entry for the effect-receipts page is ratcheted for the findings this branch removed. The gate reports three further below baseline that belong to the peer's #2198, #2203 and #2206.

Gates

Run by the orchestrator on the rebased head after the agent's own run.

npx vitest run packages/core lexicons/k8s   458 files passed; the two security-boundary suites timed out under the run and pass alone (6/6), the flake the brief documents
npx tsc --noEmit                       clean
npx tsx scripts/typecheck.ts           37 known failure(s), no regressions (37 baselined)
npx tsx scripts/check-lexicons.ts      every lexicon 23/23 tier-1, no untracked failures
chant dev check-lexicon lexicons/k8s   23/23 tier 1
node scripts/lint-docs-sentences.mjs   4106 gated finding(s), no regressions
node scripts/check-docs-diataxis.mjs   clean
npx vitest run examples/fold-differential.test.ts   112 passed

Read first

lexicons/k8s/src/serializer.ts for the trailing-comment channel, then receipt-store.ts for the address derivation, then the deep-observe test asserting the receipt is never drift.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FoXyD9UvKQ5ZdhiR9JT1yB